SaaS Sprawl Audit: A Practical Process for Australian SMEs

If you cannot tell us in 30 seconds how many SaaS subscriptions your business pays for, you have SaaS sprawl. For a typical sub-$10M Australian SME, 5% to 12% of recurring SaaS spend is duplicated, unused, or forgotten. This post walks through a four-step audit you can finish before EOFY.

Why SaaS sprawl is a financial problem, not just an IT one

This is a deliberately financial post. We have a separate piece coming on Shadow IT, which covers the security angle. The audit process below is the one we run when a CFO calls us in May or June and says some version of: “I think we are paying for too much software and I do not really know what we have.” That conversation has happened more times this year than in the previous three combined, and EOFY is the moment to fix it because every subscription you cancel before 30 June reduces your run-rate cost for FY27.

SaaS sprawl is not a security incident, it is a slow leak. It happens because individual product subscriptions are small enough to fall under the discretionary spend threshold of most managers ($50 to $200 a month on a credit card), and big enough collectively to fund another two staff members. For an illustrative 48-staff professional services firm with around $7.5M revenue, a SaaS bill of $186,000 a year is entirely plausible. After audit, we cut it to $142,000 without removing any meaningful capability. That is one and a half graduate salaries, sitting in software nobody used.

We run this exercise inside our managed IT engagements and as standalone projects. The methodology has stabilised into a four-step process that works for any SME with bookkeeping in Xero or MYOB and an executive willing to make some decisions.

Step 1: Extract the spend data

The first step sounds easy and is usually the hardest. You need a clean, single-source list of every recurring software charge the business has paid for in the last 12 months. Not what the IT register says you have. What the bank account and the credit card statements prove you have.

Pulling data from Xero

For Xero-based businesses, the export workflow is:

1. Go to Accounting, Reports, Account Transactions
2. Set the date range to the last 13 months (you want one full year plus the current month for renewal visibility)
3. Filter by the expense accounts you typically book software to: usually ‘Software Subscriptions’, ‘IT Expenses’, ‘Computer Software’, ‘Cloud Services’, and sometimes ‘Marketing’ for tools that snuck in via that team
4. Export as CSV

You also need the credit card transaction export, separately, because half the rogue subscriptions are on staff cards and never get coded to a software account. Pull the last 13 months of card statements and grep for any merchant name that looks like a SaaS vendor.

Pulling data from MYOB

For MYOB Business or AccountRight users, the workflow is similar: Reports, Accounts, Find Transactions, filter by account, export to Excel. The chart of accounts in MYOB tends to be messier than Xero in our experience, so you will want to also pull the All Journals report for the period and search the description column for known SaaS vendor names.

The Microsoft 365 admin centre and Google Workspace

Do not forget the platform you are already on. Microsoft 365 and Google Workspace both have a billing section showing all subscriptions, seat counts, and the per-seat price. Pull that as a separate dataset. You will use it later when you check seat utilisation against headcount.

At the end of step 1, you should have a single spreadsheet with columns for: vendor name, total annual spend, monthly spend (if recurring), billing frequency, payment method, charge account, and a blank column for ‘function’ which we fill in next.

Step 2: Deduplicate by function

This is where the audit gets interesting. Most SMEs do not think they have duplicate tools. Almost all of them do. The trick is to categorise every tool by the job it does, and then look for jobs being done twice.

Use a six-category matrix:

For each line in your spreadsheet from step 1, assign a category. Then sort by category and look for duplicates within each category. The patterns we find most often:

• Three project management tools, because each department picked their own and never standardised
• Two e-signature platforms (DocuSign for legal, Adobe Sign because it came in Acrobat Pro)
• Paid Zoom Pro alongside Teams Phone, when nobody actually needs Zoom anymore
• An old CRM still being paid for after the team migrated to a new one 18 months ago
• Multiple file-sharing tools (Dropbox, OneDrive, Google Drive, Box) because different teams brought in different ones
• Two password managers, one of which has six active users out of 40 seats paid

The team in our audit example that kept paying for Trello two years after moving to ClickUp is not an exaggeration. The Trello bill was $18 a user per month for 12 seats, $2,592 a year, billed to the credit card of a manager who left in 2024. Nobody had thought to cancel it because nobody had thought about it at all.

Step 3: Map each tool to a business owner

For every line in your now-deduplicated list, you need a named human who owns the decision to keep, kill, or consolidate. This is the step that breaks the audit at most SMEs, because nobody wants to own a tool nobody uses, and nobody wants to admit they signed up for the thing in the first place.

The ownership conversation

Run this as a structured exercise, not an email thread. Get the leadership team in a room with the spreadsheet on a screen. For each line, the question is: “Who is the business owner of this tool?” If nobody puts their hand up, that is the strongest possible signal that the tool should be killed.

Owners need two responsibilities clearly stated:

• They authorise the spend
• They are accountable for whether the business gets value from the tool

For tools that survive ownership assignment, you also want a documented use case (“we use Asana for client project tracking across the consulting team, 18 users”) and a renewal date.

Seat utilisation check

For every tool the business is keeping, pull the actual seat utilisation in the last 30 days. Most SaaS vendors have a ‘last active’ or ‘last login’ field in the admin console. Compare paid seats to actively used seats.

A creative agency with 38 Adobe Creative Cloud licences for 24 people is the classic case. The previous office manager had set up seats for every staff member because Adobe ran a promotion in 2022. Of the 38 seats, 19 had been used in the prior 90 days. Cutting back to 25 seats (24 plus one buffer) saved $11,800 a year. They had been paying $880 a month for unused creative software for 18 months.

Step 4: Kill, consolidate, keep

The final step is the decision. Every tool in your spreadsheet ends up in one of three buckets.

Kill

Tools with no owner, no use case, or zero seat utilisation. Cancel them before the next renewal. For tools billed monthly, the cancellation is easy. For tools on annual contracts, mark the renewal date in the calendar and set a reminder for 60 days prior.

Watch for cancellation friction. Some SaaS vendors require you to call a sales rep to cancel, especially on enterprise tiers. Budget time for this. Some require 30 or 60 days notice. Read the terms before you assume you can cancel today.

Consolidate

Two tools doing the same job, both with active users. The owner of each tool needs to pick one and migrate. Set a realistic migration timeline (usually 60 to 90 days for a project management tool migration; longer for a CRM) and a hard cancellation date for the loser.

Migration is the step where consolidation projects die. Account for the cost: someone needs to actually do the work, and the loser tool needs to stay paid until the migration completes. Build that into the savings calculation.

Keep

Tools with a clear owner, an active use case, and reasonable seat utilisation. For these, the audit work is rightsizing the seat count and aligning the billing frequency. Annual billing is usually 10% to 20% cheaper than monthly. If you are confident in the keep decision, switch to annual at renewal.

Typical wins for a sub-$10M SME

For Australian SMEs in the $2M to $10M revenue band, we consistently see SaaS audit savings of 5% to 12% of total SaaS spend. The mix typically breaks down like this:

For an illustrative 32-staff software business with $4.8M revenue and $94,000 of annual SaaS spend pre-audit, the savings might break down as $11,200 from killing unused tools, $9,800 from consolidating overlapping tools, $6,400 from rightsizing seats, and $2,100 from billing switches. Total $29,500 a year, 31% reduction. The audit itself took about 14 hours of staff time across three weeks.

The Excel template

The template we use internally has six tabs. You can build your own in an afternoon:

1. Raw data: CSV exports from Xero or MYOB, pasted as-is, one tab per source
2. Consolidated list: deduplicated by vendor, with annual spend, monthly spend, billing frequency, category, owner, use case, and decision (kill/consolidate/keep) columns
3. Seat utilisation: for each kept tool, the paid seats vs active seats vs target seats
4. Renewal calendar: all renewal dates in date order, colour-coded by criticality
5. Savings tracker: per-decision annualised saving, with a running total
6. Action log: what we cancelled, when, what we consolidated, and the realisation date for each saving

The most important tab is the action log. Audits are easy. Execution is hard. Without a tracked action log, half the decisions never get implemented and the savings never land.

Common mistakes during SaaS audits

Not including microservices and add-ons

Many tools are sold as the base product plus per-feature add-ons. HubSpot, Salesforce, Microsoft 365, Adobe Creative Cloud, all have premium add-ons that are often turned on by accident or for a one-off campaign and never turned off. Audit add-ons separately, not just the base product.

Ignoring the implicit licence inside another product

This is the biggest miss. If you are paying for Microsoft 365 Business Premium at $33 per user per month, you already have Teams (voice optional), SharePoint, OneDrive, Exchange, Intune, Defender for Office 365, Azure AD Premium P1, and Power Automate Free. If you are also paying for Slack, Dropbox, a separate identity provider, or a third-party MDM, you are paying twice. Map the included entitlements of your platform tier before assessing the standalone tools.

Forgetting personal credit card subscriptions

If staff expense SaaS through reimbursement, those subscriptions never hit the company card. They live in the expense system. Pull a year of expense claims and search for any vendor name that smells like software.

Treating it as a one-off

SaaS sprawl is a continuous problem. Without a recurring process, you will be back where you started in 18 months. Build a quarterly mini-audit into the finance calendar: every quarter, pull new SaaS charges, check ownership and use case, and add to the central register. This is the kind of governance that comes naturally inside a managed IT services arrangement with per-user fixed monthly pricing, because the MSP has a vested interest in keeping the SaaS register clean.

How this connects to your broader IT environment

A clean SaaS register is a precondition for several other things you probably need to do this year. It feeds directly into your cybersecurity posture, because every SaaS tool is an authentication surface and a data exfiltration risk. It feeds into your Privacy Act compliance, because the 2024 reforms require you to know where personal information lives, and ‘in some SaaS tool nobody can remember the name of’ is no longer acceptable. It also feeds your cloud services strategy, because a deduplicated tool stack is much easier to integrate and govern.

For Essential Eight alignment specifically, the audit is the foundation of the User Application Hardening control. You cannot harden applications you do not know exist.

When to bring in external help

You can run the audit yourself if you have a financially literate operations manager with a few spare hours each week and an executive willing to make decisions. If you do not, or if you suspect the audit will surface uncomfortable conversations about who signed up for what, an external party makes the process faster and less politically charged.

TechAssist runs SaaS audits as a standalone engagement or as part of broader managed IT onboarding. Our team of 13 Melbourne-employed staff includes the people who actually know which Microsoft 365 entitlements overlap with which standalone tools, which matters because most of the consolidation savings hide in that overlap. We run audits out of both our Tecoma office and our Bourke Street CBD office, so we can do the workshop in person wherever your team is. If you want to start a conversation, the EOFY window is the right time.

Frequently Asked Questions

How long does a typical SaaS audit take?

For a 30 to 80-staff SME, plan on 12 to 20 hours of work spread over three weeks. The data extraction is the longest single task. The decisions can be made in two or three workshops if leadership is willing to commit time.

Can we just use a SaaS management platform like Vendr or Zylo?

Those tools are excellent for businesses with 200+ staff and SaaS bills over $500,000. For sub-$10M SMEs, the licence cost of the management tool is often higher than the savings it surfaces. Excel and a focused three-week project produce 90% of the result at 10% of the cost.

Should we cancel everything that has zero use, or migrate users first?

Confirm zero use across at least 90 days before cancelling, and notify the listed billing contact (not just the technical contact) before pulling the plug. Some tools are ‘used’ only at month-end or quarter-end and look dormant at other times. A 90-day window catches most of these.

What about free SaaS tools, do they matter for the audit?

From a cost perspective, no. From a security and governance perspective, very much yes. Free tools are where the data leaks happen. That conversation belongs in the Shadow IT review, not the financial audit.

Do we need to involve our MSP in the audit?

If you have one, yes. Your MSP often holds the admin credentials to half the tools you are auditing, knows the seat utilisation in real time, and can execute the cancellations on your behalf. If you run a co-managed IT arrangement, this is the kind of work that should already be part of your quarterly review with the MSP.

When is the right time of year to run the audit?

April or May, to bank the FY27 savings before 30 June. Cancellations made in May reduce your run-rate for FY27 and improve your EBITDA position before EOFY. Audits run in September or October are still valuable, but you have given up a year of savings.